I would like to drop certain fields from elasticsearch indexing but retain them for output to another destination.
I have two use cases
- Some fields contain detail that I only want for an investigation and do not want to index
- Metrics fields that I want to send to a graphite aggregator and not to an Index.
Is there a way to select "if output == elasticsearch then drop fields f1, f2, f3 ?